Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(): Sign releaser artifacts, not only container manifests #2789

Merged
merged 2 commits into from Sep 7, 2022
Merged

build(): Sign releaser artifacts, not only container manifests #2789

merged 2 commits into from Sep 7, 2022

Commits on Sep 5, 2022

  1. Sign releaser artifacts, not only container manifests 

    The current goreleaser configuration leverages cosign to sign the
goreleaser container manifests using public sigstore infrastructure.
This is great!

This PR also signs the rest of the releaser artifacts (binaries, sbom
file, etc), so we can verify them using the aforementioned public
infrastructure. This is very useful for folks consuming the binaries
from the public GitHub releases.

Note that this assumes that the OIDC issuer is GitHub, and thus ties
this signature to be triggered a GitHub action.

Signed-off-by: Juan Antonio Osorio <juan.osoriorobles@eu.equinix.com>
    @JAORMX
    JAORMX committed Sep 5, 2022
    Configuration menu
    Copy the full SHA
    4647447 View commit details
    Browse the repository at this point in the history

  2. Add --skip-sign flat to goreleaser ran in tests 

    We only want to sign artifacts and containers when releasing, not
necessarily when testing PRs.

Signed-off-by: Juan Antonio Osorio <juan.osoriorobles@eu.equinix.com>
    @JAORMX
    JAORMX committed Sep 5, 2022
    Configuration menu
    Copy the full SHA
    249b7a0 View commit details
    Browse the repository at this point in the history